A cybersecurity stock trading at about 11x sales sounds expensive. For SailPoint, that multiple sits close to its own history and near the average for the wider tech universe, while Okta looks more stretched by the same measure.
The more useful question is whether SailPoint’s growth, retention and margins actually justify the price. SailPoint is the only publicly traded pure-play in identity governance. It reported fiscal Q2 2027 results on 9 September 2026 and has built an AI agent security story around its purchase of Entro Security.
If growth quality holds, the current price may prove reasonable. If migration fades and the AI story stalls, the multiple has little room to absorb disappointment.
This SailPoint stock analysis gives you a framework for testing whether the company’s growth quality supports its valuation. It is not a buy or sell call.
Why does SailPoint’s position beside Okta matter for investors?
IGA versus IAM explained
Identity access management (IAM) decides who gets in. Identity governance and administration (IGA) decides what that person may do once inside, and whether they should still have that access.
Consider a new finance hire. Okta confirms her login through single sign-on and multifactor authentication. SailPoint decides which payroll systems she can touch, flags any conflict between approving and paying invoices, removes her access when she leaves, and produces the audit evidence that proves all of it.
That is why the two often sit side by side. SailPoint says it supports over 1,200 enterprise applications, although its investor deck describes this capability in fairly vague marketing language.
Where the competition bites
The pairing is common, but it is not universal. Every competitor in SailPoint’s niche is private, which makes SailPoint the only listed way to own pure governance exposure.
| Company | Primary role | Where it is strongest |
|---|---|---|
| Okta | Access management | Single sign-on, multifactor authentication |
| SailPoint | Identity governance | Complex, legacy and on-premise estates |
| Microsoft Entra ID Governance | Bundled governance | Microsoft-centred environments |
| Saviynt | Cloud IGA | Governance combined with access and privileged access |
| CyberArk | Identity security | Privileged access and machine identities |
About 97% of Okta’s business is access management and roughly 3% is IGA, a segment Okta says is growing quickly. Industry comparisons framing Okta’s governance product as lighter than SailPoint’s have not been independently confirmed. That split tells you Okta is not yet a governance-first rival, but the “complement” label could erode if Okta pushes harder into IGA.
When big ASX news breaks, our subscribers know first
Is the SaaS migration a growth engine or a one-time lift?
The headline numbers are strong. In fiscal Q2 2027, total annual recurring revenue (ARR, the yearly value of subscription contracts) reached $1.231 billion, up 25%. SaaS ARR grew faster, rising 36% to $847 million.
| Metric | Fiscal 2026 | Fiscal Q2 2027 |
|---|---|---|
| Total ARR | $1.125B (up 28%) | $1.231B (up 25%) |
| SaaS ARR | $746M (up 38%) | $847M (up 36%) |
| Revenue | $1.071B (up 24%) | $308.8M (up ~17%) |
| Net revenue retention | Flat near 113% | 113% |
The gap between SaaS ARR growth and total ARR growth comes from conversions. When Thoma Bravo bought SailPoint for about $6.9 billion in 2022, SaaS made up around 26% of revenue. That share is now above 60%. SailPoint says customers typically expand two to three times after moving from on-premise licences to its cloud platform.
One caution applies when quoting growth. Recent subscription revenue growth of around 19% and total revenue growth of about 17% measure different things.
The open question is what happens when conversions run out. One reading treats migration as a temporary boost. The other treats it as a platform for selling more modules, seats and workloads.
Net revenue retention (NRR) separates those readings. NRR measures how much revenue existing customers generate this year compared with last year, including upgrades and losses. SailPoint’s figure has sat near 113% for three years.
The retention gap SailPoint’s NRR is 113%. Healthy SaaS firms often post 120% or more.
If NRR stays near 113% while migration fades, you should expect growth to drift toward the underlying expansion rate. Fiscal 2027 guidance of $1.265-$1.275 billion in revenue and $1.364-$1.374 billion in ending ARR still looks healthy. Even so, the SaaS ARR headline alone cannot justify the multiple.
How credible is the AI agent identity opportunity after Entro?
The bull mechanism
An AI agent is not one account. It may call several tools, APIs, databases and SaaS applications, generating credentials, tokens and delegated permissions along the way. Each of these needs an owner, controls and a way to revoke it.
Demonstrated AI-powered cyberattacks, including agents that sat undetected inside production systems for months, show why ungoverned machine credentials are a real exposure and not just a sales pitch.
The investment logic runs in four steps:
- AI adoption increases the number of identities and credentials.
- Each one needs governance, from ownership through to revocation.
- Human-centric IAM handles fast-changing, autonomous machine access poorly.
- Vendors that can discover and govern these identities may sell new modules.
SailPoint announced the Entro acquisition on 15 June 2026 and closed it on 29 June 2026. The deal adds non-human identity security to its Agentic Fabric platform. SailPoint did not disclose official terms. External reports cited about $200 million, while reporting on its 10-Q put the cash consideration at around $122.6 million. The company holds about $300 million in cash and an undrawn $250 million credit facility earmarked for acquisitions.
Why the ratios overstate the market
The ratios used to describe the opportunity vary widely. The original source cited about 40 non-human identities per human. Rubrik and CyberArk citations put the figure at 82:1, and Zscaler suggested more than 140 agentic identities per person. None of these figures has been independently verified.
The sceptical points matter:
- Many machine identities are low-risk, short-lived or already managed by other tools.
- A token does not equal a licence or proportional revenue.
- Spending may consolidate into cloud, privileged access and cloud-native application protection (CNAPP) vendors.
These ratios describe complexity, not revenue. AI-driven ARR is under 6% of the total today, while SailPoint targets at least $800 million by fiscal 2029, about 38% of a $2.1 billion goal. That means you are being asked to underwrite a category that barely shows up in the numbers yet. Treat revenue growth acceleration as the proof point.
Do margins, stock-based compensation and the Rule of 40 hold up?
On the surface, the margin picture looks reassuring. The Rule of 40 says a software company’s growth rate plus its profit margin should reach at least 40%. SailPoint scores 48%.
The market now pays more for a strong Rule of 40 score than it did three years ago, which is why SailPoint’s 48% reading matters for its multiple, provided you check how much of it depends on adjusted figures.
Check how that score is built:
- Take ARR growth rather than revenue growth, which is the faster of the two measures.
- Add adjusted operating margin, which excludes stock-based compensation. It was about 18% in fiscal 2026 and 20.3% in Q2 2027.
- Compare the result with reported figures, and note that the company is not profitable on a net basis.
The gap shows up across the accounts. Adjusted subscription gross margin is 72%, against roughly 67% on a regular basis. Free cash flow was $52 million in fiscal 2026 and $37.4 million in Q2 2027, a 12.1% margin. Management guides to about $200 million this year and at least $400 million by fiscal 2029.
Stock-based compensation (SBC) is the main complication. SBC means paying staff in shares, which dilutes existing holders. A widely quoted $39.8 million figure is only one part of the IPO-related charge.
| Fiscal 2026 IPO-related component | Amount |
|---|---|
| Modified incentive units | $61.5M |
| Equity appreciation rights | $12.6M |
| Cash-settled awards | $39.8M |
| Total | $113.8M |
SBC at 6-7% of revenue is considered normal, and anything above 20% is considered excessive. A $290 million grant vesting over four years works out to about $73 million a year. Broader estimates of around $310 million in annual SBC remain unverified. The Rule of 40 pass is real, but it rests on adjusted numbers, so watch whether SBC settles under 10% of revenue before trusting the margin story.
Is about 11x sales a fair price, and what could go wrong?
Valuation against three benchmarks
On 25 October 2026, SailPoint traded at $21.79, giving it a $12.44 billion market capitalisation, according to Investing.com. Barron’s quoted $20.06 two days earlier. The Okta figures come from differently dated sources, so treat the comparison as approximate.
| Benchmark | Price-to-sales |
|---|---|
| SailPoint (FY2026 revenue) | ~11.6x |
| SailPoint own average | ~8x |
| Tech catalogue average | ~8.7x |
| Okta (long-run average ~6x) | ~14.3x |
SailPoint sits above its own average but well below Okta, which trades at more than double its long-run norm.
SailPoint’s multiple also has to be read against broader SaaS valuation compression, where large-cap software has traded about a standard deviation below historical norms despite the strongest growth readings in three years.
Bull case versus bear case
Analyst views split along one line: how durable growth will be once migration fades.
| Source | View | Target |
|---|---|---|
| Barron’s (27 ratings) | Average | $22.44 (range $17-$30) |
| KeyBanc | Sector Weight | ~$20.58 |
| Roth Capital | Buy | $19 |
| Cantor Fitzgerald | Overweight | Not reported |
None of these analyst views has been independently verified. Bulls point to the installed base of customers still able to migrate and to a new market in AI agent identity. Bears note that KeyBanc’s fair value equates to about 8x forward revenue and argue that migration, AI and margins must all work at once.
The average target sits only about 3% above the recent price. You should read that as the market already pricing in success on both migration and AI, which leaves little cushion if either disappoints.
Risks that could compress the multiple
- SBC and dilution, if the IPO spike does not normalise.
- Thoma Bravo overhang, with reported ownership of about 85% (unverified) raising the prospect of share sales.
- NRR plateau around 113%.
- Migration cliff once the largest customers have converted.
- Sector-wide re-rating, because cybersecurity stocks tend to move together.
Entro integration, competition and AI overreach sit just behind these five.
What the multiple already assumes, and what to track next
SailPoint looks roughly average against history, but the price still demands simultaneous success in migration, AI and margin expansion. Track three measures each quarter:
- NRR moving from 113% towards 120%.
- SBC falling below 10% of revenue.
- AI-driven ARR progressing towards $800 million.
If all three improve, about 11x sales could look cheap in hindsight. If NRR stalls while SBC stays high, the same multiple starts to look stretched.
This article is for informational purposes only and should not be considered financial advice. Investors should conduct their own research and consult with financial professionals before making investment decisions. Past performance does not guarantee future results, and financial projections and targets are subject to market conditions and various risk factors.
